My name isJeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.

It's often worth reading through these instructions and printing them for ease of reference.

If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.

Please reply to this thread. Do not start a new topic.

If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.

Please be sure to subscribe to the topic if you have not already done so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.

Having said that.... Let's get going!!
----------

Is this a business computer by chance?

Topics are closed if you do not respond within 3 days.
If I am working with you and have not responded in a couple of days please PM me.

If you are satisfied with the help that you have received, please consider a donation.

Well...since it is your business you can give me authorization to help. Would you like to continue? If so, please run a new Quick Scan with OTL and then post the OTL.txt log that is made and also do the following...

File Found : C:\ENDFile Found : C:\Users\Juanita\AppData\Roaming\Mozilla\Firefox\Profiles\xc76rcld.default\searchplugins\Conduit.xmlFile Found : C:\Users\Juanita\AppData\Roaming\Mozilla\Firefox\Profiles\xc76rcld.default\searchplugins\MyStart Search.xmlFile Found : C:\Users\Juanita\AppData\Roaming\Mozilla\Firefox\Profiles\xc76rcld.default\user.jsFile Found : C:\Windows\system32\ImhxxpComm.dllFile Found : C:\Windows\System32\Tasks\DealplyFile Found : C:\Windows\Tasks\Dealply.jobFolder Found C:\Program Files\ConduitFolder Found C:\Program Files\SearchprotectFolder Found C:\ProgramData\ConduitFolder Found C:\Users\Juanita\AppData\Local\ConduitFolder Found C:\Users\Juanita\AppData\Local\Temp\SmartbarFolder Found C:\Users\Juanita\AppData\Local\WajamFolder Found C:\Users\Juanita\AppData\LocalLow\ConduitFolder Found C:\Users\Juanita\AppData\Roaming\SearchprotectFolder Found C:\Windows\system32\ARFCFolder Found C:\Windows\system32\jmdpFolder Found C:\Windows\system32\WNLT

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\ConduitKey Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopesKey Found : HKCU\Software\AppDataLow\Software\smartbarKey Found : HKCU\Software\IMKey Found : HKCU\Software\ImInstallerKey Found : HKCU\Software\SearchProtectKey Found : HKCU\Software\smartbarKey Found : HKCU\Software\smartbarbackupKey Found : HKCU\Software\smartbarlogKey Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}Key Found : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}Key Found : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}Key Found : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}Key Found : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}Key Found : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}Key Found : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattributeKey Found : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanelKey Found : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarKey Found : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobjectKey Found : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystateKey Found : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuformKey Found : HKLM\SOFTWARE\Classes\Toolbar.CT3153924Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3310511Key Found : HKLM\Software\ConduitKey Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancsKey Found : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasapi32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasmancsKey Found : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasapi32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasmancsKey Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\DealplyKey Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{67B180A7-13E0-4BD6-98E7-DD733A39E4B8}Key Found : HKLM\Software\SearchProtectKey Found : HKLM\Software\wnltValue Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

0 user(s) are reading this topic

About What the Tech

Tom (Coyote) Wilson started this site as TomCoyote.org in 2002. Along with SpywareInfo, it was one of the first places to offer online malware removal training in its Classroom. Cluster headaches forced retirement of Tom in 2007, and the site was renamed "What the Tech". Free malware removal help and training has remained a constant.